Data Privacy Governance as a Source of Competitive Advantage

Abstract

Today, many people have said that data privacy management can provide an edge to a business against its competitors. However, the timing of this is unknown. In fact, some studies indicate that privacy regulations might be more beneficial to the large companies than the small ones. This conceptual paper examines this issue. It adopts two popular concepts from strategy research: the resource-based view and the dynamic capabilities view. First, the paper separates privacy governance from simple legal compliance. It then regards governance as a scale (or a scale-like object). On the bottom side, a firm just responds to the law. On the high end, a firm handles privacy maturely and flexibly. The paper then merges four potential means of value of privacy governance: customer trust, reduction of risk, improved data quality, the ability to adapt. It evaluates each one based on VRIN (valuable, rare, inimitable, non-substitutable) criteria: is it valuable, rare, hard to copy, and is it hard to replace? Trust, lower risk, and better data quality do add value. But they are not always rare and difficult to duplicate. It is only an adaptive governance that will be difficult to imitate. The paper also demonstrates that regulation has an impact. The more there is variation in rules, the more valuable the ability to coordinate is. Firms will then determine whether they have the resources to develop this ability. The paper concludes with a straightforward framework, three propositions to be tested, and ideas for future research.